CVE-2026-75464: OneNav Arbitrary File Deletion Vulnerability

CVE-2026-75464 Overview

CVE-2026-75464 is an authenticated arbitrary file deletion vulnerability in OneNav 1.2.4, a self-hosted bookmark management application. The flaw resides in the import_link() function, which fails to properly restrict file paths supplied by authenticated users. An attacker with valid credentials can send crafted requests to delete arbitrary files on the underlying server, including configuration files, application data, or system files accessible to the web service account. The vulnerability is classified under CWE-552: Files or Directories Accessible to External Parties.

Critical Impact
Authenticated attackers can delete arbitrary files on the server, leading to data loss, application disruption, and potential denial of service.

Affected Products

OneNav version 1.2.4

Discovery Timeline

2026-08-24 - CVE-2026-75464 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-75464

Vulnerability Analysis

OneNav is an open-source bookmark navigation application written in PHP. The import_link() function handles bookmark import operations and includes logic that removes files as part of the import workflow. The function accepts a user-controlled parameter that specifies the target file, but does not sufficiently validate or sanitize the path before invoking a deletion routine.

Because the deletion path is not constrained to a safe import directory, an authenticated user can supply a traversal sequence or absolute path. The application then removes the referenced file with the privileges of the web server process. This turns a routine import feature into a file destruction primitive available to any authenticated account.

Root Cause

The root cause is missing path validation and containment within import_link(). The function trusts client-supplied file references and does not confirm that the target resides inside the expected import staging directory. This aligns with [CWE-552], where sensitive files become reachable through improperly restricted application interfaces.

Attack Vector

Exploitation requires network access to the OneNav web interface and valid authenticated credentials. An attacker submits a crafted import request containing a manipulated path parameter that references a file outside the intended import location. The server processes the request through import_link() and deletes the referenced file. Refer to the GitHub Security Advisory for CVE-2026-75464 for exploitation specifics.

Detection Methods for CVE-2026-75464

Indicators of Compromise

Unexpected deletion of files owned by the web server user, particularly configuration files, database files, or content outside the OneNav application directory.
HTTP requests to OneNav import endpoints containing path traversal sequences such as ../ or absolute filesystem paths in parameter values.
Authenticated session activity from unusual source IP addresses immediately preceding file loss events.

Detection Strategies

Inspect web server access logs for POST requests to OneNav import handlers that carry suspicious filename or path parameters.
Enable PHP audit logging of unlink() and related filesystem calls to correlate deletions with HTTP requests.
Deploy file integrity monitoring on the OneNav host to alert on removal of files outside expected application working directories.

Monitoring Recommendations

Alert on any file deletion outside the OneNav data directory performed by the web server process.
Track authenticated OneNav sessions that trigger repeated import operations within short intervals.
Forward web application and filesystem audit logs to a centralized analytics platform for correlation with authentication events.

How to Mitigate CVE-2026-75464

Immediate Actions Required

Restrict access to the OneNav administrative interface to trusted networks or through a VPN until a patched release is deployed.
Rotate credentials for all OneNav accounts and enforce strong, unique passwords to reduce the risk of authenticated abuse.
Back up the OneNav installation directory and database so that any file deletion can be recovered quickly.
Review web server and application logs for evidence of prior exploitation attempts targeting the import functionality.

Patch Information

Monitor the upstream project for a fixed release addressing the import_link() file deletion flaw. Review the OneNav Release v1.2.4 notes and the GitHub Security Advisory for CVE-2026-75464 for updated version guidance. Apply the fixed version as soon as it becomes available and validate the update in a staging environment.

Workarounds

Run the OneNav web server process under a dedicated low-privilege account with filesystem write access limited to the application directory.
Apply operating system access controls that deny the web service account write or delete permissions on files outside its working directory.
Place OneNav behind a reverse proxy or web application firewall that blocks requests containing path traversal sequences in import parameters.
Disable the bookmark import feature at the reverse proxy layer if it is not required in your deployment.

bash

# Example nginx rule to block path traversal in OneNav import requests
location ~ ^/index\.php {
    if ($args ~* "\.\./|\.\.\\|%2e%2e") {
        return 403;
    }
    if ($request_body ~* "\.\./|\.\.\\|%2e%2e") {
        return 403;
    }
}